Error connecting to redis in Authentication-Service plugin

[alexevansvu]

What product are you having troubles with?

Marketplace

What Console version are you using?

1.102.8

Description

When attempting to start the Authentication-Service with environment variables to connect to a redis server, we get the following error:

We believe we have the correct environment variables configured for the authentication service, and confirmed we can connect to the server via redis-cli from a pod on the Authentication-Service container.

Below are the environment variables we specify for the service:

The config files (including the ca.crt) do exist and are mounted.
Notably, we get a different error if we remove the TLS related variables, rather than the Go application crashing we get a response from the redis server in the logs of the authentication service noting the failure to connect.

We believe the issue is with the certs but are unable to prove that. Something specific to our situation is that our redis cert does not contain the full trust chain, so we need to include a chain of intermediate certs in the cert file we mount on the container. Could that be the issue? If not, what else could we be missing?

Actual Outcome

An error is logged by the go application specifying that the redis variables are not configured correctly

Expected Outcome

Service starts successfully with connection to redis

[alexevansvu]

I forgot to mention, we are using version 3.9.0 of the authentication-service plugin

[davidebianchi]

Hi @alexevansvu!
It seems an error in the documentation. What if you try inserting the certificate instead of the path as the value of the REDIS_TLS_CACERT?

[alexevansvu]

So, I tried copying over the contents two ways. First by replacing all new lines with the characters '\n", and second just copying directly (replacing all new lines with a white space), in both cases I get the same error. Could it be due to the fact that we have multiple certificates in that file (and thus multiple certificates in the variable?)

[davidebianchi]

It should works correctly also with multiple certificates in a file. Are you adding the certificates directly inside the environment variables section of the service? Or with replaces from e.g. public variables?
You can try to mount the CA reading the variable from the ConfigMap (or a secret), in this case the encoding should be handled correctly.

[fredmaggiowski]

@alexevansvu just to make sure: are the certificates PEM formatted?

[alexevansvu]

@davidebianchi following your advise earlier, I tried entering directly into the environment variable. Previously we loaded it as a config map and passed the path to that config map as the environment variable. I'll try loading the content and referencing it instead

@fredmaggiowski The certificates are in fact PEM formatted

[alexevansvu]

We pivoted to working on another aspect of the project where we ran into this so we haven't tried the latest suggestion of loading it from a config map or a secret yet. I'll update here with whether or not it worked once we get back to it

[alexevansvu]

We opted to go in a different direction for using Redis in this project. We planned on using a Redis server external to the namespace for this but we've decided to use a Redis microservice in the namespace instead.

So, while we didn't resolve the certificate issue it's now a moot point for us.